9eb483ee92
Enhance OPC ingestor with Redis authentication and update Helm chart configurations. Improve README for clarity on Docker and Kubernetes setup.
74 lines
1.9 KiB
Markdown
74 lines
1.9 KiB
Markdown
# How to create an image and deploy this helm chart:
|
|
|
|
## Image creation:
|
|
### Generate your ssh key to Docker
|
|
```
|
|
ssh-keygen -t ed25519 -C "docker-access" -f ~/.ssh/id_ed25519_docker
|
|
```
|
|
|
|
Add the public key to yout Git SSH keys in your git platform
|
|
|
|
### Enable Docker BuildKit
|
|
```
|
|
export DOCKER_BUILDKIT=1
|
|
```
|
|
or make it permanent:
|
|
```
|
|
echo '{ "features": { "buildkit": true } }' | sudo tee /etc/docker/daemon.json
|
|
sudo systemctl restart docker
|
|
```
|
|
|
|
### Build and upload image
|
|
```
|
|
make -C docker
|
|
```
|
|
|
|
## SSH secrets:
|
|
|
|
### Create secret to your git ssh credentials
|
|
We need a dedicated keypair to access GitHub from a Kubernetes pod without exposing your user credentials or tokens.
|
|
```
|
|
ssh-keygen -t ed25519 -f git_key -C "k8s-deploy-key" -N ""
|
|
```
|
|
- ```-t ed25519```: modern, secure key type
|
|
|
|
- ```-f git_key```: saves to git_key (private) and git_key.pub (public)
|
|
|
|
- ```-C "..."```: comment to identify this key
|
|
|
|
- ```-N ""```: no passphrase (for non-interactive use in pods)
|
|
|
|
### Add the Public Key to GitHub (Read-Only Deploy Key)
|
|
Deploy keys allow read-only access to a specific repo. This avoids using user tokens or giving broad permissions.
|
|
|
|
1. Copy your public key:
|
|
```
|
|
cat git_key.pub
|
|
```
|
|
|
|
2. Go to your GitHub repo → Settings → Deploy Keys
|
|
|
|
3. Click “Add deploy key”
|
|
|
|
- Title: K8s ReadOnly
|
|
|
|
- Key: paste your git_key.pub
|
|
|
|
- ✅ Check “Allow read access”
|
|
|
|
- ❌ Do NOT check “Allow write access”
|
|
|
|
### Create a Kubernetes Secret from the Private Key
|
|
Kubernetes Secrets securely store sensitive data like private keys. This secret will later be mounted into your pod for Git to use.
|
|
```
|
|
kubectl create secret generic git-ssh-key \
|
|
--namespace sientia-opc \
|
|
--from-file=ssh-privatekey=git_key \
|
|
--type=kubernetes.io/ssh-auth
|
|
```
|
|
- ```ssh-privatekey```: required key name for type kubernetes.io/ssh-auth
|
|
|
|
- Secret is base64-encoded and stored in Kubernetes (not encrypted unless you're using an external secret manager or encryption at rest is enabled)
|
|
|
|
|